CWE-284 · Improper Access Control (page 47)
Page 47 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43977 | Critical | 9.8 | 2023-01-17 | An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks acces… |
CVE-2015-10057 | Medium | 4.6 | 2023-01-16 | A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-22600 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Im… |
CVE-2023-22487 | High | 7.7 | 2023-01-11 | Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the… |
CVE-2023-21752 | High | 7.1 | 2023-01-10 | Windows Backup Service Elevation of Privilege Vulnerability |
CVE-2023-21750 | High | 7.1 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21742 | High | 8.8 | 2023-01-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-21531 | High | 7.0 | 2023-01-10 | Azure Service Fabric Container Elevation of Privilege Vulnerability |
CVE-2022-45166 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used… |
CVE-2022-45164 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created… |
CVE-2022-36443 | High | 7.8 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card)… |
CVE-2022-36442 | Medium | 5.5 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized appl… |
CVE-2022-36441 | High | 7.1 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applicati… |
CVE-2022-4711 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to… |
CVE-2022-4709 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to… |
CVE-2022-4708 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up t… |
CVE-2022-4705 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, a… |
CVE-2022-4704 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, a… |
CVE-2022-4703 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to… |
CVE-2022-4702 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to… |
CVE-2022-4700 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to… |
CVE-2023-22903 | Critical | 9.8 | 2023-01-10 | api/views/user.py in LibrePhotos before e19e539 has incorrect access control. |
CVE-2023-0017 | Critical | 9.4 | 2023-01-10 | An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an ope… |
CVE-2023-0012 | Medium | 6.4 | 2023-01-10 | In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicio… |
CVE-2023-22473 | Low | 2.1 | 2023-01-09 | Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud… |
CVE-2022-23508 | High | 8.8 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i… |
CVE-2014-125054 | Medium | 4.3 | 2023-01-07 | A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulat… |
CVE-2022-47543 | Medium | 5.3 | 2023-01-05 | An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects. |
CVE-2021-4300 | Medium | 6.3 | 2023-01-04 | A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the… |
CVE-2022-47634 | High | 8.1 | 2023-01-01 | M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain H… |
CVE-2022-34672 | High | 7.8 | 2022-12-30 | NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the softwar… |
CVE-2022-4814 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4810 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4807 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-45778 | Critical | 9.8 | 2022-12-27 | https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in… |
CVE-2022-45431 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sendi… |
CVE-2022-45430 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sen… |
CVE-2022-4724 | Critical | 9.8 | 2022-12-27 | Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-44014 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks… |
CVE-2022-44565 | Medium | 5.3 | 2022-12-23 | An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a… |
CVE-2022-4689 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4684 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-23513 | Medium | 5.3 | 2022-12-23 | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor w… |
CVE-2022-41654 | Medium | 4.3 | 2022-12-22 | An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request ca… |
CVE-2022-3186 | High | 8.6 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main manage… |
CVE-2022-38655 | Medium | 6.4 | 2022-12-21 | BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES S… |
CVE-2022-38546 | Medium | 5.3 | 2022-12-21 | A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS s… |
CVE-2022-44643 | Medium | 5.7 | 2022-12-20 | A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy… |
CVE-2022-28173 | Critical | 9.1 | 2022-12-19 | The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker c… |
CVE-2022-4567 | High | 8.1 | 2022-12-17 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-31708 | Medium | 4.9 | 2022-12-16 | vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity rang… |
CVE-2022-25627 | Medium | 6.7 | 2022-12-16 | An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Man… |
CVE-2022-42865 | Medium | 5.5 | 2022-12-15 | This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may… |
CVE-2022-42862 | Medium | 5.5 | 2022-12-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Pri… |
CVE-2022-42861 | High | 8.8 | 2022-12-15 | This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-42859 | Medium | 5.5 | 2022-12-15 | Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be… |
CVE-2022-42853 | Medium | 5.5 | 2022-12-15 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the… |
CVE-2022-32945 | Medium | 4.3 | 2022-12-15 | An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record a… |
CVE-2022-47407 | Medium | 6.5 | 2022-12-14 | An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a… |
CVE-2022-38355 | High | 7.5 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose… |
CVE-2022-46664 | High | 8.1 | 2022-12-13 | A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4), Mendix Workflow C… |
CVE-2022-46354 | Medium | 5.3 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-45937 | High | 8.8 | 2022-12-13 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2022-45936 | High | 8.1 | 2022-12-13 | A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle access control for som… |
CVE-2022-41261 | Medium | 6.0 | 2022-12-12 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can… |
CVE-2022-23485 | Medium | 6.4 | 2022-12-10 | Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invit… |
CVE-2022-44932 | High | 7.5 | 2022-12-08 | An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service. |
CVE-2022-39915 | Low | 3.3 | 2022-12-08 | Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), a… |
CVE-2022-39910 | Low | 3.9 | 2022-12-08 | Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of a… |
CVE-2022-39906 | Low | 2.3 | 2022-12-08 | Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information. |
CVE-2022-39900 | Medium | 4.6 | 2022-12-08 | Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the… |
CVE-2022-39898 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. |
CVE-2022-39896 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. |
CVE-2022-39895 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit inte… |
CVE-2022-39894 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via imp… |
CVE-2022-37918 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37917 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37916 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-35843 | High | 8.1 | 2022-12-06 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9… |
CVE-2022-44212 | Medium | 5.9 | 2022-12-01 | In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. |
CVE-2022-44211 | High | 7.4 | 2022-12-01 | In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-4229 | High | 7.3 | 2022-11-30 | A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_… |
CVE-2022-44037 | High | 8.8 | 2022-11-29 | An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to acce… |
CVE-2022-45475 | Medium | 6.5 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application… |
CVE-2022-38377 | Medium | 4.3 | 2022-11-25 | An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 a… |
CVE-2022-39070 | Critical | 9.8 | 2022-11-22 | There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to… |
CVE-2022-4087 | Low | 2.6 | 2022-11-21 | A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of… |
CVE-2022-41155 | Medium | 5.3 | 2022-11-19 | Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress. |
CVE-2022-41135 | Medium | 6.5 | 2022-11-18 | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. |
CVE-2022-40216 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. |
CVE-2022-34827 | Critical | 9.9 | 2022-11-18 | Carel Boss Mini 1.5.0 has Improper Access Control. |
CVE-2022-41652 | Medium | 6.5 | 2022-11-18 | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-24038 | Medium | 6.5 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the a… |
CVE-2022-24036 | High | 8.6 | 2022-11-16 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs. |
CVE-2022-20918 | High | 7.5 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER m… |
CVE-2022-25679 | Medium | 6.2 | 2022-11-15 | Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sna… |
CVE-2022-42126 | Medium | 4.3 | 2022-11-15 | The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check… |
CVE-2022-36789 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may al… |